Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 00:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe
-
Size
454KB
-
MD5
b4b627c160bfb57646740daae4494bb0
-
SHA1
5af789697b565bb2fc769958986d7696cdd6c9f8
-
SHA256
bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0
-
SHA512
a7d142360ed0d0c8f0ebd28a214aba94bd12530241b3fbebe11aaeae7de607abcf613f348397856328fa1196b4815bc8a104e5e5909278aa440fa6f8863a0f5a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT:q7Tc2NYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2932-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/892-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1212-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/892-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-640-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-842-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-1047-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-1102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1260 hnhhhb.exe 5096 djvvd.exe 4840 3vjjj.exe 1412 jvpjd.exe 1216 3nnttb.exe 1668 rffffll.exe 2916 tbtttb.exe 3236 vvjdd.exe 512 fxfrlfr.exe 3868 pjddv.exe 2548 nbnbnt.exe 2440 rflxrll.exe 4144 bnnnhb.exe 3304 tbhbtn.exe 2784 pdjjv.exe 3012 3vvvv.exe 1396 jjvpv.exe 1120 rfxllll.exe 5020 1xxrrll.exe 3948 bbhhhn.exe 2868 hhbhbh.exe 1708 vvjvp.exe 1744 httbbn.exe 5060 fffxlrl.exe 4564 jvpvj.exe 4044 3bhhht.exe 2244 lxxlxlf.exe 892 ntbtnh.exe 5056 1jppj.exe 2956 7btbbt.exe 400 jjjvp.exe 1600 ffrlfrr.exe 556 3hhhbh.exe 1996 djvvj.exe 4700 nhhhhn.exe 1892 ddjdd.exe 1032 rffffff.exe 1696 pvdjd.exe 2820 llxrxxr.exe 2852 nbhbhn.exe 3944 dpddd.exe 1464 hhhnhn.exe 3528 ddddd.exe 2836 lxrfxxl.exe 4360 djvjj.exe 1868 xflfffr.exe 2856 jjjjj.exe 4332 vvdvp.exe 4336 ntbtnn.exe 4784 fxrflrf.exe 1360 3hnntt.exe 4656 dppjj.exe 4880 fllfflf.exe 2108 tbtbhb.exe 3736 jjjdv.exe 3668 flrrxrx.exe 1764 jjvpd.exe 2100 xfxrfxr.exe 1176 tthhbh.exe 4740 pjjpj.exe 2300 lrrlffx.exe 3380 tbnhnh.exe 3208 rxfrlrl.exe 2000 tbhbnh.exe -
resource yara_rule behavioral2/memory/2932-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/892-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1212-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/780-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/892-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-651-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flrrfx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 1260 2932 bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe 83 PID 2932 wrote to memory of 1260 2932 bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe 83 PID 2932 wrote to memory of 1260 2932 bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe 83 PID 1260 wrote to memory of 5096 1260 hnhhhb.exe 84 PID 1260 wrote to memory of 5096 1260 hnhhhb.exe 84 PID 1260 wrote to memory of 5096 1260 hnhhhb.exe 84 PID 5096 wrote to memory of 4840 5096 djvvd.exe 85 PID 5096 wrote to memory of 4840 5096 djvvd.exe 85 PID 5096 wrote to memory of 4840 5096 djvvd.exe 85 PID 4840 wrote to memory of 1412 4840 3vjjj.exe 86 PID 4840 wrote to memory of 1412 4840 3vjjj.exe 86 PID 4840 wrote to memory of 1412 4840 3vjjj.exe 86 PID 1412 wrote to memory of 1216 1412 jvpjd.exe 87 PID 1412 wrote to memory of 1216 1412 jvpjd.exe 87 PID 1412 wrote to memory of 1216 1412 jvpjd.exe 87 PID 1216 wrote to memory of 1668 1216 3nnttb.exe 88 PID 1216 wrote to memory of 1668 1216 3nnttb.exe 88 PID 1216 wrote to memory of 1668 1216 3nnttb.exe 88 PID 1668 wrote to memory of 2916 1668 rffffll.exe 89 PID 1668 wrote to memory of 2916 1668 rffffll.exe 89 PID 1668 wrote to memory of 2916 1668 rffffll.exe 89 PID 2916 wrote to memory of 3236 2916 tbtttb.exe 90 PID 2916 wrote to memory of 3236 2916 tbtttb.exe 90 PID 2916 wrote to memory of 3236 2916 tbtttb.exe 90 PID 3236 wrote to memory of 512 3236 vvjdd.exe 91 PID 3236 wrote to memory of 512 3236 vvjdd.exe 91 PID 3236 wrote to memory of 512 3236 vvjdd.exe 91 PID 512 wrote to memory of 3868 512 fxfrlfr.exe 92 PID 512 wrote to memory of 3868 512 fxfrlfr.exe 92 PID 512 wrote to memory of 3868 512 fxfrlfr.exe 92 PID 3868 wrote to memory of 2548 3868 pjddv.exe 93 PID 3868 wrote to memory of 2548 3868 pjddv.exe 93 PID 3868 wrote to memory of 2548 3868 pjddv.exe 93 PID 2548 wrote to memory of 2440 2548 nbnbnt.exe 94 PID 2548 wrote to memory of 2440 2548 nbnbnt.exe 94 PID 2548 wrote to memory of 2440 2548 nbnbnt.exe 94 PID 2440 wrote to memory of 4144 2440 rflxrll.exe 95 PID 2440 wrote to memory of 4144 2440 rflxrll.exe 95 PID 2440 wrote to memory of 4144 2440 rflxrll.exe 95 PID 4144 wrote to memory of 3304 4144 bnnnhb.exe 96 PID 4144 wrote to memory of 3304 4144 bnnnhb.exe 96 PID 4144 wrote to memory of 3304 4144 bnnnhb.exe 96 PID 3304 wrote to memory of 2784 3304 tbhbtn.exe 97 PID 3304 wrote to memory of 2784 3304 tbhbtn.exe 97 PID 3304 wrote to memory of 2784 3304 tbhbtn.exe 97 PID 2784 wrote to memory of 3012 2784 pdjjv.exe 98 PID 2784 wrote to memory of 3012 2784 pdjjv.exe 98 PID 2784 wrote to memory of 3012 2784 pdjjv.exe 98 PID 3012 wrote to memory of 1396 3012 3vvvv.exe 99 PID 3012 wrote to memory of 1396 3012 3vvvv.exe 99 PID 3012 wrote to memory of 1396 3012 3vvvv.exe 99 PID 1396 wrote to memory of 1120 1396 jjvpv.exe 100 PID 1396 wrote to memory of 1120 1396 jjvpv.exe 100 PID 1396 wrote to memory of 1120 1396 jjvpv.exe 100 PID 1120 wrote to memory of 5020 1120 rfxllll.exe 101 PID 1120 wrote to memory of 5020 1120 rfxllll.exe 101 PID 1120 wrote to memory of 5020 1120 rfxllll.exe 101 PID 5020 wrote to memory of 3948 5020 1xxrrll.exe 102 PID 5020 wrote to memory of 3948 5020 1xxrrll.exe 102 PID 5020 wrote to memory of 3948 5020 1xxrrll.exe 102 PID 3948 wrote to memory of 2868 3948 bbhhhn.exe 103 PID 3948 wrote to memory of 2868 3948 bbhhhn.exe 103 PID 3948 wrote to memory of 2868 3948 bbhhhn.exe 103 PID 2868 wrote to memory of 1708 2868 hhbhbh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe"C:\Users\Admin\AppData\Local\Temp\bd0895adc43f670fa8e12e8186e27d18d5c41de100b9930aef7e839565a484a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\hnhhhb.exec:\hnhhhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\djvvd.exec:\djvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\3vjjj.exec:\3vjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\jvpjd.exec:\jvpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\3nnttb.exec:\3nnttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\rffffll.exec:\rffffll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\tbtttb.exec:\tbtttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\vvjdd.exec:\vvjdd.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\fxfrlfr.exec:\fxfrlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\pjddv.exec:\pjddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\nbnbnt.exec:\nbnbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\rflxrll.exec:\rflxrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\bnnnhb.exec:\bnnnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\tbhbtn.exec:\tbhbtn.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\pdjjv.exec:\pdjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\3vvvv.exec:\3vvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\jjvpv.exec:\jjvpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\rfxllll.exec:\rfxllll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\1xxrrll.exec:\1xxrrll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\bbhhhn.exec:\bbhhhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\hhbhbh.exec:\hhbhbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\vvjvp.exec:\vvjvp.exe23⤵
- Executes dropped EXE
PID:1708 -
\??\c:\httbbn.exec:\httbbn.exe24⤵
- Executes dropped EXE
PID:1744 -
\??\c:\fffxlrl.exec:\fffxlrl.exe25⤵
- Executes dropped EXE
PID:5060 -
\??\c:\jvpvj.exec:\jvpvj.exe26⤵
- Executes dropped EXE
PID:4564 -
\??\c:\3bhhht.exec:\3bhhht.exe27⤵
- Executes dropped EXE
PID:4044 -
\??\c:\lxxlxlf.exec:\lxxlxlf.exe28⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ntbtnh.exec:\ntbtnh.exe29⤵
- Executes dropped EXE
PID:892 -
\??\c:\1jppj.exec:\1jppj.exe30⤵
- Executes dropped EXE
PID:5056 -
\??\c:\7btbbt.exec:\7btbbt.exe31⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jjjvp.exec:\jjjvp.exe32⤵
- Executes dropped EXE
PID:400 -
\??\c:\ffrlfrr.exec:\ffrlfrr.exe33⤵
- Executes dropped EXE
PID:1600 -
\??\c:\3hhhbh.exec:\3hhhbh.exe34⤵
- Executes dropped EXE
PID:556 -
\??\c:\djvvj.exec:\djvvj.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1996 -
\??\c:\nhhhhn.exec:\nhhhhn.exe36⤵
- Executes dropped EXE
PID:4700 -
\??\c:\ddjdd.exec:\ddjdd.exe37⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rffffff.exec:\rffffff.exe38⤵
- Executes dropped EXE
PID:1032 -
\??\c:\pvdjd.exec:\pvdjd.exe39⤵
- Executes dropped EXE
PID:1696 -
\??\c:\llxrxxr.exec:\llxrxxr.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nbhbhn.exec:\nbhbhn.exe41⤵
- Executes dropped EXE
PID:2852 -
\??\c:\dpddd.exec:\dpddd.exe42⤵
- Executes dropped EXE
PID:3944 -
\??\c:\hhhnhn.exec:\hhhnhn.exe43⤵
- Executes dropped EXE
PID:1464 -
\??\c:\ddddd.exec:\ddddd.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3528 -
\??\c:\lxrfxxl.exec:\lxrfxxl.exe45⤵
- Executes dropped EXE
PID:2836 -
\??\c:\djvjj.exec:\djvjj.exe46⤵
- Executes dropped EXE
PID:4360 -
\??\c:\xflfffr.exec:\xflfffr.exe47⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jjjjj.exec:\jjjjj.exe48⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vvdvp.exec:\vvdvp.exe49⤵
- Executes dropped EXE
PID:4332 -
\??\c:\ntbtnn.exec:\ntbtnn.exe50⤵
- Executes dropped EXE
PID:4336 -
\??\c:\fxrflrf.exec:\fxrflrf.exe51⤵
- Executes dropped EXE
PID:4784 -
\??\c:\3hnntt.exec:\3hnntt.exe52⤵
- Executes dropped EXE
PID:1360 -
\??\c:\dppjj.exec:\dppjj.exe53⤵
- Executes dropped EXE
PID:4656 -
\??\c:\fllfflf.exec:\fllfflf.exe54⤵
- Executes dropped EXE
PID:4880 -
\??\c:\tbtbhb.exec:\tbtbhb.exe55⤵
- Executes dropped EXE
PID:2108 -
\??\c:\jjjdv.exec:\jjjdv.exe56⤵
- Executes dropped EXE
PID:3736 -
\??\c:\flrrxrx.exec:\flrrxrx.exe57⤵
- Executes dropped EXE
PID:3668 -
\??\c:\jjvpd.exec:\jjvpd.exe58⤵
- Executes dropped EXE
PID:1764 -
\??\c:\xfxrfxr.exec:\xfxrfxr.exe59⤵
- Executes dropped EXE
PID:2100 -
\??\c:\tthhbh.exec:\tthhbh.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1176 -
\??\c:\pjjpj.exec:\pjjpj.exe61⤵
- Executes dropped EXE
PID:4740 -
\??\c:\lrrlffx.exec:\lrrlffx.exe62⤵
- Executes dropped EXE
PID:2300 -
\??\c:\tbnhnh.exec:\tbnhnh.exe63⤵
- Executes dropped EXE
PID:3380 -
\??\c:\rxfrlrl.exec:\rxfrlrl.exe64⤵
- Executes dropped EXE
PID:3208 -
\??\c:\tbhbnh.exec:\tbhbnh.exe65⤵
- Executes dropped EXE
PID:2000 -
\??\c:\jjdpd.exec:\jjdpd.exe66⤵PID:1436
-
\??\c:\fffxrlx.exec:\fffxrlx.exe67⤵
- System Location Discovery: System Language Discovery
PID:2632 -
\??\c:\xxlfrlr.exec:\xxlfrlr.exe68⤵PID:3592
-
\??\c:\nhbbtt.exec:\nhbbtt.exe69⤵PID:2440
-
\??\c:\jjvpv.exec:\jjvpv.exe70⤵PID:4912
-
\??\c:\rxrxfxr.exec:\rxrxfxr.exe71⤵PID:4024
-
\??\c:\tnnnhh.exec:\tnnnhh.exe72⤵PID:3148
-
\??\c:\llflllr.exec:\llflllr.exe73⤵PID:2784
-
\??\c:\rrfllrr.exec:\rrfllrr.exe74⤵PID:4668
-
\??\c:\3bhbbh.exec:\3bhbbh.exe75⤵PID:2772
-
\??\c:\pdjpp.exec:\pdjpp.exe76⤵PID:3588
-
\??\c:\rrrrffx.exec:\rrrrffx.exe77⤵PID:3860
-
\??\c:\bbbbbb.exec:\bbbbbb.exe78⤵PID:2328
-
\??\c:\jjjjp.exec:\jjjjp.exe79⤵PID:3276
-
\??\c:\3rxxxfl.exec:\3rxxxfl.exe80⤵PID:764
-
\??\c:\thtbbb.exec:\thtbbb.exe81⤵PID:1224
-
\??\c:\jjvjj.exec:\jjvjj.exe82⤵PID:2364
-
\??\c:\fflllrr.exec:\fflllrr.exe83⤵PID:1556
-
\??\c:\tbbhnt.exec:\tbbhnt.exe84⤵PID:3492
-
\??\c:\ppppp.exec:\ppppp.exe85⤵PID:2924
-
\??\c:\llllfff.exec:\llllfff.exe86⤵PID:4564
-
\??\c:\fflffrf.exec:\fflffrf.exe87⤵PID:3956
-
\??\c:\5bhbbh.exec:\5bhbbh.exe88⤵PID:712
-
\??\c:\vpddd.exec:\vpddd.exe89⤵
- System Location Discovery: System Language Discovery
PID:2244 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe90⤵PID:4924
-
\??\c:\3bhhht.exec:\3bhhht.exe91⤵PID:652
-
\??\c:\djjdd.exec:\djjdd.exe92⤵PID:2956
-
\??\c:\xxxxfll.exec:\xxxxfll.exe93⤵PID:1052
-
\??\c:\3nhhnt.exec:\3nhhnt.exe94⤵PID:4228
-
\??\c:\7hnhhh.exec:\7hnhhh.exe95⤵PID:4928
-
\??\c:\jvpjv.exec:\jvpjv.exe96⤵
- System Location Discovery: System Language Discovery
PID:3296 -
\??\c:\lllxrlf.exec:\lllxrlf.exe97⤵PID:1996
-
\??\c:\bbhhnt.exec:\bbhhnt.exe98⤵PID:4712
-
\??\c:\dvdjv.exec:\dvdjv.exe99⤵PID:3724
-
\??\c:\dpjpp.exec:\dpjpp.exe100⤵PID:2608
-
\??\c:\bbnbhb.exec:\bbnbhb.exe101⤵PID:4472
-
\??\c:\7dddj.exec:\7dddj.exe102⤵PID:2344
-
\??\c:\ffrfrll.exec:\ffrfrll.exe103⤵PID:1212
-
\??\c:\lfllrff.exec:\lfllrff.exe104⤵PID:4400
-
\??\c:\djvdp.exec:\djvdp.exe105⤵PID:1536
-
\??\c:\dpvdp.exec:\dpvdp.exe106⤵PID:972
-
\??\c:\rxllrrf.exec:\rxllrrf.exe107⤵PID:3940
-
\??\c:\nbbbnn.exec:\nbbbnn.exe108⤵PID:2828
-
\??\c:\vjdjj.exec:\vjdjj.exe109⤵PID:816
-
\??\c:\xfrrfrr.exec:\xfrrfrr.exe110⤵PID:1496
-
\??\c:\bbhhnb.exec:\bbhhnb.exe111⤵PID:2856
-
\??\c:\5dddd.exec:\5dddd.exe112⤵PID:4324
-
\??\c:\lrllffr.exec:\lrllffr.exe113⤵PID:4336
-
\??\c:\hnhhbh.exec:\hnhhbh.exe114⤵PID:4784
-
\??\c:\jjpjj.exec:\jjpjj.exe115⤵PID:1360
-
\??\c:\lrlxrll.exec:\lrlxrll.exe116⤵PID:4632
-
\??\c:\tbhttt.exec:\tbhttt.exe117⤵PID:4880
-
\??\c:\vvpvj.exec:\vvpvj.exe118⤵PID:2108
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe119⤵PID:3736
-
\??\c:\hnnhbt.exec:\hnnhbt.exe120⤵PID:3668
-
\??\c:\vvjjp.exec:\vvjjp.exe121⤵PID:780
-
\??\c:\frxrfrl.exec:\frxrfrl.exe122⤵PID:4876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-